MasterStudy LMS Pro WordPress Plugin Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the MasterStudy LMS Pro plugin for WordPress, affecting all versions through 4.7.0. The issue arises from a lack of proper file type validation in the 'stm_lms_add_assignment_attachment' function. This vulnerability enables authenticated attackers with Subscriber-level access or higher to upload arbitrary files to the server, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, which may be used to execute malicious code on the server.

Remediation

Users are advised to update to version 4.7.1 or a newer patched version.